Password Generator — Unbiased, and It Shows the Bits
Settings
Password
This session
Passwords you make will be listed here, newest first.
Passwords are made by your own browser and are never sent anywhere. Closing the tab clears the list.
About the Password Generator
Set a length, choose which kinds of characters to include, and generate. The password is made in your browser and never leaves it.
Two things here are done differently from most generators, and both are invisible unless someone says so. Characters are picked by discarding the random values that would land unevenly and drawing again, rather than by taking a remainder — a remainder makes the first few characters of the pool very slightly more likely. And when you ask for at least one digit or one symbol, the tool satisfies that by drawing a new password, not by inserting a character into a fixed slot. Inserting is the common shortcut and it makes that one position predictable.
The strength readout is a number of bits rather than a colored bar, because a bar has no defined meaning and bits do: it is the length multiplied by the base-two logarithm of how many characters were available. Sixteen characters from the full set comes to about a hundred bits.
Nothing is stored. The short list below the box holds what you made in this tab so a regenerate does not lose one you liked, and it disappears with the tab.
How to use it
- Pick the length first. Length buys more strength than variety does: adding four characters helps more than adding a symbol type to a short password.
- Leave every type on unless a site refuses symbols. Some older systems still do, and that is the only good reason to turn one off.
- Turn on the ambiguous-character option if you will read the password aloud or copy it by hand onto paper.
- Use the copy button rather than selecting the text, and paste it straight into the place it belongs.
- If you cannot store it in a password manager, generate a shorter one you can actually remember to type, and keep the long ones for accounts your browser fills in.
Questions
Is it free, and do I need an account?
Free, and there is no account. The password is generated by your own browser, so signing in would serve no purpose here — there is nothing on our side to attach it to.
Does the password get sent to your server?
No, and there is no server to send it to. The site is static files, the generator is a script running on your machine, and nothing about the password is transmitted, logged or stored. Closing the tab clears the list.
How is this different from the generator built into my browser?
For most people it is not better, and a browser generator that also saves the password is more useful than a page you have to copy from. This one is for the cases where that is not available: a device that is not yours, a password you need to read out, or a length or character set your browser will not give you.
How long should a password be?
For anything a password manager will remember, sixteen characters from the full set is comfortable and lands at about a hundred bits. For something you must type from memory, length still beats complexity, which is why a long passphrase of unrelated words outperforms a short jumble.
What does the bits number actually mean?
It is how many yes-or-no questions an attacker would have to answer to reach your password by guessing, assuming they know exactly how it was made. Each added bit doubles the work. It is a fair measure for passwords generated at random, and it is far too generous for passwords a person invented, because people do not choose evenly.
Can I reuse one password everywhere if it is strong?
No, and this is the one place where strength does not help. When a site is breached the attacker gets that password, and reuse turns one breach into every account you own. A unique password per site is the point of a generator.